Skip to content
Fencer Vulns
medium 5.3

CVE-2025-20196 json

A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentic…

published 2025-05-07 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-13896

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits
0
none known

Summary

A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the Cisco IOx application hosting environment to stop responding, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to cause the Cisco IOx application hosting environment to stop responding. The IOx process will need to be manually restarted to recover services.

Patch / fix

  • cisco cgr1000_firmware 15.9\(3\)m12
  • cisco ic3000_industrial_compute_gateway_firmware 1.5.2
  • cisco 807_industrial_integrated_services_router_firmware 15.9\(3\)m11
  • cisco 809_industrial_integrated_services_router_firmware 15.9\(3\)m11
  • cisco 829_industrial_integrated_services_router_firmware 15.9\(3\)m11
  • cisco ios_xe 17.15.2

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Cisco IOS
  • Cisco Cisco IOS XE Software

Classification

Weakness
  • CWE-307 Improper Restriction of Excessive Authentication Attempts
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.